vulkro triage

Advisory only, off by default, bring your own key

vulkro triage is the only part of Vulkro that calls a model. Every verdict it prints is labelled advisory, non-deterministic, and excluded from the benchmark. It never changes the deterministic scan findings, their severities, or the JSON scan output the benchmark consumes.

An opt-in, advisory second opinion. vulkro triage runs a normal deterministic scan, then asks a model for an advisory judgement on the intent-class findings that determinism cannot settle on its own: entitlement / paid-tier bypass, PII / object-property over-exposure, operational reachability of one-off scripts, and source trust.

The scan engine stays 100% deterministic and network-free. The advisory verdicts live in a separate report and are never merged back into the scan result.

Usage

vulkro triage [PATH] [FLAGS]

PATH is the project root and defaults to the current directory.

Flags

Flag	Description	Default
--model <MODEL>	Model id for the advisory judgement. Defaults to a small, fast Anthropic model.	(a small Anthropic model)
--format, -f <FMT>	table (human summary) or json (the advisory verdicts as a JSON array).	table

Environment variables

Name	Effect
VULKRO_TRIAGE_API_KEY	Bring-your-own Anthropic API key. Required. ANTHROPIC_API_KEY is accepted as a fallback. With neither set, the command exits 2 with a "set VULKRO_TRIAGE_API_KEY" message.
VULKRO_OFFLINE	When set, vulkro triage refuses to run, because it makes an outbound API call. It exits 2 with guidance. The deterministic scan is unaffected and stays fully offline.

The lens is off unless you run this subcommand and supply your own key.

Exit codes

Code	Meaning
0	Scan completed and no intent-class candidates needed triage.
1	Scan completed and advisory verdicts were reported.
2	Error: missing key, VULKRO_OFFLINE set, bad path, or API failure.

What the output carries

The json output is wrapped in an envelope that makes its status explicit:

{
  "advisory": true,
  "non_deterministic": true,
  "excluded_from_benchmark": true,
  "note": "Advisory LLM triage verdicts. These NEVER change the deterministic scan findings, their severities, or the benchmark. Read them as a second opinion only.",
  "total_findings": 0,
  "candidates": 0,
  "verdicts": []
}

total_findings is the full deterministic count; candidates is how many intent-class findings were handed to the model; verdicts is the advisory array. The deterministic findings are never present in, or altered by, this document.

Relationship to the scan

vulkro triage is a lens on top of a normal scan, not a replacement for it. The scan it runs is the same deterministic pipeline every other command runs. For CI and any reproducible gate, use vulkro scan; reach for vulkro triage only when you want an advisory human-in-the-loop second opinion on the intent-class findings.

Examples

# Advisory triage of the current project (requires your own API key).
export VULKRO_TRIAGE_API_KEY=sk-ant-...
vulkro triage .

# JSON verdicts for a pipeline that records the second opinion separately.
vulkro triage . --format json > triage-advisory.json

# Pin a specific model.
vulkro triage . --model claude-...-latest

Related

• vulkro scan - the deterministic, offline scan that produces the findings triage comments on.
• Air-gap: offline mode - VULKRO_OFFLINE and the network-free contract this command deliberately opts out of.